The Equifax Breach Exposes America's Identity Crisis

An Example: https://www.aclu.org/other/5-problems-national-id-cards

And some arguments are laughable.

> What happens when an ID card is stolen? What proof is used to decide who gets a card?

Mine has a picture on it. If this argument is true, then why does any country issue passports, drive licenses, etc...? Why do security enforce agencies have identifications? They are not perfect, but they work.

> An ID card system will lead to a slippery slope of surveillance and monitoring of citizens.

The "slippery slope" theory is just the straw-man fallacy on disguise.

> A national ID would require a governmental database of every person in the U.S. containing continually updated identifying information. It would likely contain many errors, any one of which could render someone unemployable and possibly much worse until they get their ""file"" straightened out.

This is the definition of what Equifax is. But it gets worse as people gets into no flight lists because they share the same name than a person of interest. The lack of an ID card just magnifies the problem, it doesn't makes it disappear. (http://www.nbcsandiego.com/news/local/Same-Name-Mistaken-Ide...)

> How long before office buildings, doctors' offices, gas stations, highway tolls, subways and buses incorporate the ID card into their security or payment systems for greater efficiency?

This information is already available for credit card companies. Is that better? And in Europe we have ID cards, and they are not used for any of that things. Except maybe the doctor office, as your life depends on having reliable data and it is part of your health care rights provided by the government.

> A national ID card would have the same effect on a massive scale, as Latinos, Asians, Caribbeans and other minorities became subject to ceaseless status and identity checks from police, banks, merchants and others.

This says more about USA culture than about id cards. Also, it already happens (e.g. the POTUS pardon).

Really? I don't buy it.

A corporation needs my name, address, and probably email to do business with me. They need a credit card number when I purchase something and never else.

That's IT.

My phone number is not necessary (and everybody using it for 2 factor just makes everything less secure). What I buy is not necessary to record past fulfillment. When I buy is not necessary to record. Where I am is not necessary to record. etc. If a company stores this stuff and it gets leaked, they should be liable.

A couple of egregiously expensive fines will stop companies from collecting this information quite nicely, thank you.

Couldn't we do this thorugh a system that's similar to PKI? That is, have each person generate a private-key and certificate signing request (that's signed by the appropriate government agency)?

Resetting it outside the normal certificate expiration time would require that one go to the local branch of the government office to do so (much like getting a replacement social security card or replacing a lost or stolen passport). At that point, you would have to provide proof of your identify that would be verified by the government agency.

>I know that in Italy the tax number is used quite a lot. I could not buy a rechargable smart card for public transport, because I did not have the tax number. And when just for fun at a train ticket machine I tapped that I would like a receipt, it asked me for my tax number. Whether the number is used as an authentication method and could be misused in that context I have no idea.

No, the number is just a number, and as said it is not secret and can be generated (though with not a 100% guarantee of it being valid because of "total" homonimy).

It is only an ID number, whilst the card is (can be) a form of online ID (but only on a few specific government sites) and the said fun fact as proof of age on vending machines.

In any case it is never a password, so having it public it is not an issue, at the most you could have typed my (or someone else's) Codice Fiscale on the ticket machine, but you couldn't have used it for (if appliable) tax deduction on your name.

Except that's not always been the case, either. SSNs have always been a terrible way to disambiguate people. There are weird, crazy edge cases in SSN history. Cases exactly such as JS Jr getting the same SSN as JS III in a podunk town because the local SSA administrator was feeling lazy that day and JS III was already deceased. The federal SSA website claims that that never happened, but if you have a big enough database (say, Equifax) you can spot all kinds of simple dumb human errors like that. For many, many years the SSA left local administrators in charge: the first 5 digits and the weird way they are hyphenated were local district numbers. For people born before 2011 (!), when the new randomization scheme was switched to, there is a 90% chance you can guess their first five numbers if you know their birth date and birth city (which is why it is so ridiculous that PII rules to keep SSNs safe ever considered it fine to show only the last four, those are only meaningful digits for still the majority of SSNs in the wild).

SSNs were never designed for what the credit bureaus and banks and insurance companies (and everybody else) use them for, and there are too many cracks and failure cases. Companies need to admit their failures and come up with a real solution; but companies have so much sunk cost in SSN-keyed databases they aren't likely to ever actually do that. (Maybe this Equifax breach pushes more companies to try. Cynicism says companies remain cheap and invested in their sunk costs.)